hi im using the OpenVPN community ver. ive installed a server and a client. created certs and config files. im trying to get bi-directional vpn access (site to site) vpn tunnel is up and both sides can ping each other tunnel interface. ive added routes to internal networks and the client is able to ping servers local network. but the server couldn't ping the client local network. i can see the route on the server-side and it redirects towards the tun0 peer address (not to the client tun0 address). i can't really tell what is wrong. appreciate any help thanks [b]some details:[/b] server ver - OpenVPN 2.4.4 on ubuntu 18.0.4 client ver - OpenVPN 2.4.4 on ubuntu 18.0.4 [oconf=server config] ;local a.b.c.d port 1194 proto udp ;dev tap dev tun ca /etc/openvpn/keys/ca.crt cert /etc/openvpn/keys/server.crt key /etc/openvpn/keys/server.key dh /etc/openvpn/keys/dh2048.pem ;topology subnet server 10.8.0.0 255.255.255.0 ifconfig-pool-persist /var/log/openvpn/ipp.txt push "route 172.30.0.0 255.255.255.0" (servers lan) client-config-dir /etc/openvpn/ccd route 172.17.200.0 255.255.255.0 (client lan) keepalive 10 120 tls-auth /etc/openvpn/keys/ta.key cipher AES-256-CBC persist-key persist-tun verb 3 explicit-exit-notify 1 CCD folder routes “iroute 172.17.200.0 255.255.255.0” [/oconf] [oconf=client configuration file] client dev tun proto udp resolv-retry infinite nobind persist-key ca /etc/openvpn/keys/ca.crt cert /etc/openvpn/keys/M54.crt key /etc/openvpn/keys/M54.key remote-cert-tls server tls-auth /etc/openvpn/keys/ta.key 1 cipher AES-256-CBC verb 3 [/oconf] [b]server route table:[/b] [code]default via 172.30.0.1 dev eth0 proto dhcp src 172.30.0.139 metric 100 10.8.0.0/24 via 10.8.0.2 dev tun0 10.8.0.2 dev tun0 proto kernel scope link src 10.8.0.1 172.17.200.0/24 via 10.8.0.2 dev tun0 172.30.0.0/24 dev eth0 proto kernel scope link src 172.30.0.139 172.30.0.1 dev eth0 proto dhcp scope link src 172.30.0.139 metric 100[/code] [b]client route table:[/b] [code]default via 172.17.200.1 dev eth0 proto dhcp src 172.17.200.47 metric 100 10.8.0.1 via 10.8.0.5 dev tun0 10.8.0.5 dev tun0 proto kernel scope link src 10.8.0.6 172.17.200.0/24 dev eth0 proto kernel scope link src 172.17.200.47 172.17.200.1 dev eth0 proto dhcp scope link src 172.17.200.47 metric 100 172.30.0.0/24 via 10.8.0.5 dev tun0[/code] [b]server interfaces:[/b] [code]1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: eth0: mtu 9001 qdisc fq_codel state UP group default qlen 1000 link/ether 02:9d:b1:75:8c:1d brd ff:ff:ff:ff:ff:ff inet 172.30.0.139/24 brd 172.30.0.255 scope global dynamic eth0 valid_lft 2503sec preferred_lft 2503sec inet6 fe80::9d:b1ff:fe75:8c1d/64 scope link valid_lft forever preferred_lft forever 16: tun0: mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 100 link/none inet 10.8.0.1 peer 10.8.0.2/32 scope global tun0 valid_lft forever preferred_lft forever inet6 fe80::c4b2:d276:98d0:bcd0/64 scope link stable-privacy valid_lft forever preferred_lft forever[/code] [b]client interfaces:[/b] [code]1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: eth0: mtu 1500 qdisc mq state UP group default qlen 1000 link/ether dc:a6:32:17:ff:99 brd ff:ff:ff:ff:ff:ff inet 172.17.200.47/24 brd 172.17.200.255 scope global dynamic eth0 valid_lft 578140sec preferred_lft 578140sec inet6 fe80::dea6:32ff:fe17:ff99/64 scope link valid_lft forever preferred_lft forever 3: wlan0: mtu 1500 qdisc noop state DOWN group default qlen 1000 link/ether dc:a6:32:17:ff:9b brd ff:ff:ff:ff:ff:ff 21: tun0: mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 100 link/none inet 10.8.0.6 peer 10.8.0.5/32 scope global tun0 valid_lft forever preferred_lft forever inet6 fe80::c8df:ec27:83e4:36c0/64 scope link stable-privacy valid_lft forever preferred_lft forever[/code]

Hi everyone any ideas regarding my route issue? really need your help here. thanks

What is name of file in cdd folder? The name is important for server know how to add route if you push wrongly it not work for you . In cdd folder it shout contain a name as certificate of common name on client and inside that file contains the “iroute 172.17.200.0 255.255.255.0”

hi thanks for responding the file name is the same as cert file name (except of the file extantion of cours)

Can you post cdd file in here Iroute shoul inside file on cdd folder but not in server config . And check iptable to see if your iptable block or not

ccd M54 file: [code]“iroute 172.17.200.0 255.255.255.0”[/code] i have the "iroute" line only in ccd file but in the server file i have route [code]route 172.17.200.0 255.255.255.0[/code] the FW is disable for now on both the server and client the server is in AWS so ive open in the security group udp 1194 in on the client side all traffic is allowed out.

hi this is the output when the server loads. i see this statment "M54,10.8.0.4" while the client TUN0 ip is 10.8.0.6 dose this statment reffers to /30 subnet or thisis a misstake? nad i allso saw this error in this log [code] Options error: Unrecognized option or missing or extra parameter(s) in /etc/openvpn/ccd/M54:1: “iroute (2.4.4)[/code] Server log [code] Mon Jul 27 11:09:42 2020 WARNING: file '/etc/openvpn/keys/ta.key' is group or others accessible Mon Jul 27 11:09:42 2020 OpenVPN 2.4.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on May 14 2019 Mon Jul 27 11:09:42 2020 library versions: OpenSSL 1.1.1 11 Sep 2018, LZO 2.08 Mon Jul 27 11:09:42 2020 Diffie-Hellman initialized with 2048 bit key Mon Jul 27 11:09:42 2020 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Mon Jul 27 11:09:42 2020 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Mon Jul 27 11:09:42 2020 ROUTE_GATEWAY 172.30.0.1/255.255.255.0 IFACE=eth0 HWADDR=02:9d:b1:75:8c:1d Mon Jul 27 11:09:42 2020 TUN/TAP device tun0 opened Mon Jul 27 11:09:42 2020 TUN/TAP TX queue length set to 100 Mon Jul 27 11:09:42 2020 do_ifconfig, tt->did_ifconfig_ipv6_setup=0 Mon Jul 27 11:09:42 2020 /sbin/ip link set dev tun0 up mtu 1500 Mon Jul 27 11:09:42 2020 /sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2 Mon Jul 27 11:09:42 2020 /sbin/ip route add 172.17.200.0/24 via 10.8.0.2 Mon Jul 27 11:09:42 2020 /sbin/ip route add 10.8.0.0/24 via 10.8.0.2 Mon Jul 27 11:09:42 2020 Could not determine IPv4/IPv6 protocol. Using AF_INET Mon Jul 27 11:09:42 2020 Socket Buffers: R=[212992->212992] S=[212992->212992] Mon Jul 27 11:09:42 2020 UDPv4 link local (bound): [AF_INET][undef]:1194 Mon Jul 27 11:09:42 2020 UDPv4 link remote: [AF_UNSPEC] Mon Jul 27 11:09:42 2020 MULTI: multi_init called, r=256 v=256 Mon Jul 27 11:09:42 2020 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0 Mon Jul 27 11:09:42 2020 ifconfig_pool_read(), in='M54,10.8.0.4', TODO: IPv6 Mon Jul 27 11:09:42 2020 succeeded -> ifconfig_pool_set() Mon Jul 27 11:09:42 2020 IFCONFIG POOL LIST Mon Jul 27 11:09:42 2020 M54,10.8.0.4 Mon Jul 27 11:09:42 2020 Initialization Sequence Completed Mon Jul 27 11:09:57 2020 81.218.81.50:50722 TLS: Initial packet from [AF_INET]81.218.81.50:50722, sid=1a1dff18 28b5bf41 Mon Jul 27 11:09:57 2020 81.218.81.50:50722 VERIFY OK: depth=1, C=US, ST=NY, L=NewYork, O=Younity, OU=Eng, CN=openserver, name=EasyRSA, emailAddress=xxxxxx Mon Jul 27 11:09:57 2020 81.218.81.50:50722 VERIFY OK: depth=0, C=US, ST=NY, L=newyork, O=M54-younity, OU=Eng, CN=M54, name=EasyRSA, emailAddress=xxxxxx Mon Jul 27 11:09:57 2020 81.218.81.50:50722 peer info: IV_VER=2.4.4 Mon Jul 27 11:09:57 2020 81.218.81.50:50722 peer info: IV_PLAT=linux Mon Jul 27 11:09:57 2020 81.218.81.50:50722 peer info: IV_PROTO=2 Mon Jul 27 11:09:57 2020 81.218.81.50:50722 peer info: IV_NCP=2 Mon Jul 27 11:09:57 2020 81.218.81.50:50722 peer info: IV_LZ4=1 Mon Jul 27 11:09:57 2020 81.218.81.50:50722 peer info: IV_LZ4v2=1 Mon Jul 27 11:09:57 2020 81.218.81.50:50722 peer info: IV_LZO=1 Mon Jul 27 11:09:57 2020 81.218.81.50:50722 peer info: IV_COMP_STUB=1 Mon Jul 27 11:09:57 2020 81.218.81.50:50722 peer info: IV_COMP_STUBv2=1 Mon Jul 27 11:09:57 2020 81.218.81.50:50722 peer info: IV_TCPNL=1 Mon Jul 27 11:09:57 2020 81.218.81.50:50722 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA Mon Jul 27 11:09:57 2020 81.218.81.50:50722 [M54] Peer Connection Initiated with [AF_INET]81.218.81.50:50722 Mon Jul 27 11:09:57 2020 M54/81.218.81.50:50722 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/M54 Mon Jul 27 11:09:57 2020 M54/81.218.81.50:50722 Options error: Unrecognized option or missing or extra parameter(s) in /etc/openvpn/ccd/M54:1: “iroute (2.4.4) Mon Jul 27 11:09:57 2020 M54/81.218.81.50:50722 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled) Mon Jul 27 11:09:57 2020 M54/81.218.81.50:50722 MULTI: Learn: 10.8.0.6 -> M54/81.218.81.50:50722 Mon Jul 27 11:09:57 2020 M54/81.218.81.50:50722 MULTI: primary virtual IP for M54/81.218.81.50:50722: 10.8.0.6 Mon Jul 27 11:09:58 2020 M54/81.218.81.50:50722 PUSH: Received control message: 'PUSH_REQUEST' Mon Jul 27 11:09:58 2020 M54/81.218.81.50:50722 SENT CONTROL [M54]: 'PUSH_REPLY,route 172.30.0.0 255.255.255.0,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5,peer-id 0,cipher AES-256-GCM' (status=1) Mon Jul 27 11:09:58 2020 M54/81.218.81.50:50722 Data Channel: using negotiated cipher 'AES-256-GCM' Mon Jul 27 11:09:58 2020 M54/81.218.81.50:50722 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key Mon Jul 27 11:09:58 2020 M54/81.218.81.50:50722 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key [/code]

[quote=ahiyaz post_id=93453 time=1595848718 user_id=50960] Mon Jul 27 11:09:57 2020 M54/81.218.81.50:50722 Options error: Unrecognized option or missing or extra parameter(s) in /etc/openvpn/ccd/M54:1: “iroute (2.4.4) [/quote]Well, it's a broken CCD File ..

@ahiyaz Please use the Preview button before Submit. Thanks.

@Pippin, I(we) really appreciate the effort you make to format posts :) Thank for doing so! I might do a decent write up showing howto use BBCodes for you, properly, so you can add a link in future. Just for the record, I don't really mind if people don't use them, even if we show them how to. It shows how little care the users take when they don't use them .. Especially when they are shown they do work by your edits.

[quote=ahiyaz post_id=93450 time=1595848070 user_id=50960] ccd M54 file: [code]“iroute 172.17.200.0 255.255.255.0”[/code] i have the "iroute" line only in ccd file but in the server file i have route [code]route 172.17.200.0 255.255.255.0[/code] the FW is disable for now on both the server and client the server is in AWS so ive open in the security group udp 1194 in on the client side all traffic is allowed out. [/quote] It is correct and must have route 172.17.200.0 in server config and iroute on cdd so both need to have for site to site work . . now you need to make ipfordward and NAT in client so server can communicate with client subnet . Just do as you done with server but on client . Type this command in to terminal with sudo [Code]Iptables -t nat -A POSTROUTING -s 172.17.200.0/24 -j MASQUERADE [/code] [Code]perl -pi -e 's/#{1,}?net.ipv4.ip_forward ?= ?(0|1)/net[/code] It shout work out for you.

site to site (client side) route dont publish correctly

ahiyaz

300000 wrote inside that file just add this

iroute 172.17.200.0 255.255.255.0

this is what ive configured. and now ive tried without the apostrophes but still same result. although this time I didn't get the error message.

additionally ive just tried to configure the route manually towards 10.8.0.6 (client tun0).
but the command fails due to an invalid gateway.

root@ip-172-30-0-139:~# ip route add 172.17.200.0/24 via 10.8.0.6
Error: Nexthop has invalid gateway.
root@ip-172-30-0-139:~#

and this is becouse the mask of int tun0 at the server side is /32. i dont know if ubuntu support recursive routes.

172.17.200.0/24 via 10.8.0.2 dev tun0

tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 100
link/none
inet 10.8.0.1 peer 10.8.0.2/32 scope global tun0

ahiyaz

300000 wrote inside that file just add this

iroute 172.17.200.0 255.255.255.0

Thanks, it works!!!
i have ping from both sides.

deleting the apostrophes from the ccd file did the job.

now ill scale it up to multiple sites.

thank you all and especially "300000 "
😉 😉

« Previous Page